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ABSTRACT 



The present invention is a data processing system and 
method for providing controlled, multi-tiered checkout of a 
subset of a first data model storage (111) to a second data 
model storage (HI). The present invention include a check- 
out module (107) responsive to a user checkout request and 
a first protection level associated with the first data model 
storage (HI) for generating a subset of the first data model 
storage (111), for generating a second protection level asso- 
ciated with the subset, for updating the first protection level 
in accordance with the second protection level, and for 
updating a second data model storage (111) with the subset 
and the second protection level associated with the subset 
The present invention also includes a data manager (108) for 
managing the subsetted data in accordance with the second 
protection level. Also included in the present invention is an 
update module (109) responsive to an update request for 
updating the first data model storage (111), using a transac- 
tions data storage (113). in accordance with the modifica- 
tions made to the subsetted data using the data manager 
(108). 

12 Claims, 2 Drawing Sheets 
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SYSTEM AND METHOD FOR Another limitation with most configuration management 

CONTROLLED, MULTI-TIERED systems is that they are generally designed to operate 

SUBSETTING OF A DATA MODEL independently in one environment or on one platform. Two 

or more environments or platforms which include the same 

This application is a Continuation of application Ser. No. 3 configuration management system are generally unable to 

08/298,688. filed Aug. 31. 1994, now abandoned. share data without relinquishing control over that data. In 

_ most instances, only a simple import/export of the data 

TECHNICAL FIELD OF THE INVENTION systcms is limitation is particularly 

This invention relates generally to computer automated restricting in distributed processing systems where data is 

systems engineering (CASE) tools and in particular, to a jo transferred to other systems but, there is a need to maintain 

system and method for controlled, multi-tiered subsettlng of some level of centralized control over the data, 

a data model. What is needed is a system and method which facilitate 

BACKGROUND OF THE INVENTION controlled, multi-tiered data sharing between one or more 

, it * • . fa systems which provides protection against the occurrence of 

CASE tools, m general, are a coUecUon of progr^daU „ Z^J^ 

files, data structures, etc. which facilitate the creation of ' 

software applications. CASE tools are useful in that a user SUMMARY OF THE INVENTION 

can create applications from diagrams instead of from code. . 

In large scale environments, such as mainframe environ- The present invention facilitates controlled, multi-tiered 

menu or network environments, where a large number of „ sharing between one or more systems and further 

people simultaneously work on. or are responsible for, a provides protection against the occurrence of inconsistent 

large project, CASE tools also provide the necessary coor- out-of-sync data. 

dination and control. An example of a CASE tool is the In one embodiment of the instant invention, a user on a 

Information Engineering Facility (IEF), a product of the requesting system can checkout a subset of data stored on a 

assignee. Texas Instruments, Incorporated. ^ parent system by issuing a checkout request to the parent 

Included in most CASE tools is a configuration manage- system The checkout request not only identifies the data 

ment system through which a user can check out and check requested from the parent system, but also includes a 

in portions of the managed data. Configuration management requested protection level at which to checkout the 

systems allow multiple users to create a copy of the managed requested data. 

data, make changes to the copied data, and then update the ^ In response to the checkout request, a checkout module on 

original data with those changes. However, the technique the parent system determines the data to be subsetted from 

used by some configuration management systcms for allow- the parent system, which may include more than the 

ing multiple users to modify the same data generally does requested data, subsets the data, then determines a second 

not include mechanisms to control the level and type of protection level to grant to the requesting system on the 

modifications each user can make. All users are generally 35 subsetted data. The second protection level is determined in 

given complete control over the data requested. Thus, sev- accordance with a first protection level associated with the 

eral users may add, delete and modify the same data subsetted data on the parent system and the requested 

simultaneously and, in most cases, with little or no notifi- protection level included in the checkout request from the 

cation of these changes given to the other users. requesting system. 

A second problem with most configuration management 40 The first protection level associated with the subsetted 

systems is data inconsistency. Suppose, for example, the data on the parent system is updated in accordance with the 

configuration management system manages two data second protection level granted to the requesting system and 

objects, program A and program B. Additionally, suppose then the subsetted data and the second protection level are 

program A includes a subroutine call to program B using copied to the requesting system 

parameters W. X. Y and Z. In most configuration manage- 45 another embodiment of the present invention, the 

ment systems, one user can modify program B to instead p^ent system and the requesting system are physically the 

require parameters W, X and Y without making correspond- same system. i.e.. the parent system subsets its own data in 

ing changes to program A. The result is inconsistent data. reS ponse to a checkout request issued through the parent 

The parameters sent by program A when making the sub- system, 

routine call to program B do not agree with the parameters 50 

program B has now been modified to receive. BRIEF DESCRIPTION OF THE DRAWINGS 

One solution to the problem of data inconsistency is to Fcff ft understanding of the present invention, ref- 

define dependencies or relationships between the data. crcncc may be made to the accompanying drawings, in 

However, even if dependencies or relationships are defined wn ich: 

between the data, most configuration management systems 55 ^ gencrali2ed block diagram of one embodiment 

do not include the mechanisms necessary to use these of mc svstcm ^ mc invention; 

dependencies to control data access and data modiAcauon. nG .2 isabl<>ckdiagrarnmustratinganother embodiment 

In configuration management of the system of the present invention; 

tinle users to simultaneously change the same data, two or * y _ . 

moreversionsofmedauare^ 60 ^^^^^^^^f^' 

in order to reduce data inconsistency and maintain data ™>nt of the present invention illustrated in FIG. 2, 

integrity, one set of changes must be applied to the other set FIG. 4 is a flowchart illustrating the general operation of 

of changes. The complexity of this merger process increases the checkout module shown in FIGS. 2 and 3 of the present 

as the number of users and the number of changes to the invention; and 

same data increase. In this environment, data inconsistency 65 FIG. 5 shows a flowchart illustrating the general operation 

problems are not easily resolved thus limiting the use of of the update module shown in FIGS. 2 and 3 of the present 

automated merging techniques. invention. 
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DETAILED DESCRIPTION OF THE mation needed to construct and document business systems. 

INVENTION This information is represented in the IEF Client/Server 

The present invention facilitates controlled multi-tiered Encyclopedia as IEF data models, 

data sharing between a plurality of users wherein the occur- An IEF data model is a collection of information which 

rence of inconsistent or "out-of-sync" data is minimized 5 describes how an enterprise operates and what its system 

The present invention minimizes data inconsistency by needs axe. These models are represented in the IEF Client/ 

preventing multiple users from acquiring access to the same Server Encyclopedia as objects, properties of objects and 

data. The present invention instead generates subsets or tiers associations between objects. 

of access between successive users. Each subset or tier In the IEF Client/Server Encyclopedia, an object repre- 

includes a protection level associated with the subsetted data io scnls a si[lglc ^ itcm ^ ^ catity such as> a database 

which is based upon the protection level retained from ^ fl of a fieW 0f ^ a software application, a 

previous subsets or tiers including the same data. Trie I0g[zm modlUc properties of objects are data items which 

protection level on the subsetted data aetermines the type of g^d^ aQ ob ^ For e 4nple, properties of the 

modifications the user can make on the subsetted data^ ^ field ^^ eld ^ and a field 

Trie present invention further minimizes out-of-sync 13 J Associa tions between objects define logical connec- 

data by subsetting the data in t accordance with subset expan- g> £tween two or more objects. For exanjle. an asso- 

sion rules. Through the subset expansion rules, a parent L _ J . , , n „ ST. _ nm 

system controls the data included in a subset issued to station between one program module and another program 

aUcr system so that al^^ m «^ e is me ** ^^^^^f^t 

when a particular data item is requested Thus, through second program module t fn^bject toble can also be 

controlled, multi-tiered subsetting, the parent system retains 20 as sociated with an object "field to indicate that the field is 

control and ownership of data released to the requesting included in the table. Whether data is implemented as an 

s m object, a property of an object or an association between 

Oneembodiment of the present invention is implemented objects depends upon the particular application, 

as shown in FIG. 1. FIG. 1 illustrates a parent system 10 The IEF Workstation Toolset is a collection of programs 

coupled to a requesting system 20 through a network 30. In and data files which allow a user on a single user workstation 

this embodiment of the present invention, both the parent to edit the contents of IEF data models downloaded from an 

system 10 and the requesting system 20 are general purpose IEF Client/Server Encyclopedia and stored locally, 

digital computers which include a checkout module 107 and Under the system and method of the present invention, 

10T. respectively. The checkout modules 107 and 107' IEF users can checkout subsets of IEF data models either to 

facilitate access by the requesting system 20 to data stored another IEF Client/Server Encyclopedia or to a single user 

on the parent system 10 and access by the parent system 10 system operating under the IEF Workstation Toolset Using 

to data stored on the requesting system 20 as further the system and method of the present invention, DBF users 

described hereinbelow. can also further divide a subset and thus modify different 

Both the parent system 10 and the requesting system 20 35 sections of a previously subsetted portion of an IEF data 

are configured as shown in FIG. 2. FIG. 2 illustrates a model. 

processor 103 and data storage 105. Included in the proces- The system and method of the present invention is initi- 

sor 103 is a checkout module 107. a data manager 108 and ated when a checkout request is received from the user, 

an update module 109. Included in data storage 105 are a Checkout module 107, in response to the checkout request, 
data model storage 111 and a transactions data storage 113. ^ extracts the requested data from the data model storage 111 

The checkout module 107 processes requests from the and transfers a copy of the subset of the data model storage 

user to checkout portions of the data model storage 111 111 including the requested data from the IEF Client/Server 

stored in data storage 105. Data manager 108 is a database Encyclopedia to the requesting system 20 using transactions 

management system which controls and processes all user data storage 113. The checkout module 107 on the request- 
requests on the data stored in the data model storage 111. 45 ing system 20 then loads the data from the transactions data 

The update module 109 updates the data model storage 111 storage 113 into the data model storage 111 on the requesting 

on the parent system 10 in accordance with modifications system 20. 

made through the data manager 108. The subset of data model storage 111 transferred to the 

FIG 3 further illustrates in more detail the embodiment of requesting system 20 can be further subdivided into smaller 
the system of the present invention shown in FIG. 2. FIG. 3 5 o subsets and checked out to an IEF Workstation Toolset the 

shows that the checkout module 107 includes an extraction same IEF Client/Server Encyclopedia or to a different IEF 

module 201 and a load module 203. Also shown in FIG. 3 Client/Server Encyclopedia. 

are a generate delta module 205 and an apply module 207 Thus, using the system and method of the present 

which comprise the update module 109 shown in FIGS. 1 invention, a subset of the data model storage 111 can be 
and 2, 55 extracted from one IEF Client/Server Encyclopedia and 

In the embodiment of the present invention shown in loaded into the data model storage 111 of another IEF 

FIGS. 1 and 2. the data manager 108 and the data model Client/Server Encyclopedia. This new subset in the data 

storage 111 are implemented in the Information Engineering model storage 111 on the requesting system 20 can be further 

Facility (IEF), a set of products of the assignee, Texas subsetted to the data model storage 111 of a third IEF 
Instruments, Incorporated. IEF is a set of CASE tools which 60 Client/Server Encyclopedia or of an IEF Workstation 

automates the entire information systems life cycle from Toolset, 

planning through analysis, design, code generation and The subsetted data in the data model storage 111 on the 

maintenance. Two of the products included in the IEF are the requesting system 20 includes an associated protection level 

IEF Client/Server Encyclopedia and the IEF Workstation granted from the parent system 10 which is used by the data 
Toolset. 65 manager 108 on the requesting system 20 to control raodi- 

The IEF Client/Server Encyclopedia is a comprehensive. fications to the subsetted data. The data model storage 111 on 

multi-user database and set of tools that manages all infor- the requesting system 20 also includes the information 
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necessary to send updates to the data model storage 111 on erally the operation of checkout module 107. As shown at 

the parent system 10. decision block 301 in FIG. 4, upon receipt of the checkout 

The data model storage 111 on the parent system 10 request, the extraction module 201 of the checkout module 

includes information indicating that a particular subset is 107, as shown at block 303 determines the data to be 

checked out. thus enabling the parent system 10 to receive * inducted in the subset from the data model storage 111 on the 

modifications to the subset from the requesting system 20 Parent system 10 and checked out to the requesting system 

upon request from a user on the requesting system 20. The 20» 

information is stored as fields or as flags in the data model Extraction module 201 determines the data to be subsetted 

storage 111. The data model storage 111 on the parent system from the data model storage 111 on the parent system 10 

10 further includes a protection level associated with the *° using a set of subset expansion rules. The subset expansion 

checked out subset which prevents the checkout module 107 rules determine what data from the data model storage 111 

on the parent system 10 from granting conflicting access to on the parent system 10 to include in the subset based upon 

the data included in that subset to another system. associations or relationships to other data defined by the user 

The requesting system 20 keeps track of changes to data c and stored in the data model storage 111 on the parent 

hdudedmareceivVd subset These changes are "sent to the 15 «y«™ * '« e^ap^ar^^ 

IEF Client/Server Encyclopedia on the parent system 10 requested from the data model storage 111 on tfi ^ parent 

when a user of the IEF Client/Server Encyclopedia on the *• «J» <*V? wa * rd * ted t0 an0 * e 

requesting system 20 issues an update request to update the * c ^^^^^SJ2 

data moc£l storage ill on the parent system 10. Once the daU objects be mduded m ^ 

update of the data model storage 111 on the parent system 10 20 the data model storage 111 on the parent system 10. 

is complete change status flags within the data model The subset expansion rules are determined in relation to 

storage ill on the requesting system 20 are reset to allow a the particular implementation of the data model storage 111. 

subsequent update 10 ^ c implementation of the data model storage 111 using 

Using the present invention. IEF projects are better man- ^ ^'fj™ Encyclopedia^ for exar^e^asscc^ons 

aged by subsetting models and subset into smaller portions. 25 between data objects are classified as either ™ndatory or 

Both the IEF Ghent/Server Encyclopedia and the IEF Work- optional and within the association, one or more object, may 

station Toolset implementation* [kej track of changes made be designated as required for that associauon Thus, m 

SISSSS^^ 30 whi^require^ 

CUcnt/Scrvcr EncyclopediaTecords changes using change a checkout request including the first data object is received 

status flags stored in the data model storage 111. The IEF The checkout request from the requesting system 20 also 

Workstation Toolset implementation requires more space in includes a requested protection level. The protection level 

that it records changes by storing records in the transactions „ identifies the type of access requested on the subsetted data, 

data storage 113, thereby having the capability to include The protection levels available include delete, modify, 

duplicate transactions whereas the IEF Client/Server Ency- access and read 

dopedia implementation cannot. The delete protection level permits the requesting system 

Using the present invention, IEF projects are also better 20 to delete the subsetted data. Delete protection is granted 

managed in that the present invention prevents two users or w only when delete, modify or access protection has not 

two projects from simultaneously modifying the same data. previously been granted to another system and when all 

The current checkout process also supports the concept of associated objects are also included in the subset, 

downgrading, where data is checked out with less protection The modify protection level permits the requesting system 

than is requested. Thus, even if the user cannot modify the 20 to modify the subsetted data. Modify protection is 

subsetted data, the user may nonetheless have access to the 45 granted only when no other system has previously been 

data. The checkout of a multi-tiered subset has to take into granted either delete protection or modify protection, 

account the protection that was received when the subset of The access protection level permits the requesting system 

the data model storage 111 was checked out from the parent 20 to reference the subsetted data, Access protection is 

system 10. Therefore, a subsequent checkout of the subset- granted only when no other system has previously been 

ted data from the requesting system 20 to a second request- ^ granted delete protection, 

ing system, not shown, can include no more than access The read protection level permits the requesting system 
protection since that is all that the first requesting system 20 20 to read the subsetted data. Read protection is the lowest 
had. Thus, the present invention allows multi-tiered, con- protection level available. With read protection, the request- 
trolled updating of shared data and supports distributed i n g system 20 cannot delete, modify or reference the sub- 
computing (downsizing) without loss of control. 55 setted data. 

One embodiment of the system of the present invention Although the requesting system 20 includes a protection 

includes the parent system 10 which includes the data model level in the checkout request, the actual protection level 

storage 111 implemented using IEF Client/Server Encyclo- associated with the subsetted data is determined, as shown 

pedia and the requesting system 20 which also includes the a t block 305 in FIG. 4. by the extraction module 201 of the 
data model storage 111 implemented using IEF Client/ 60 checkout module 103 on the parent system 10 based on the 

Server Encyclopedia. protection level that the parent system 10 has on the 

In this embodiment of the present invention, the parent requested data. The parent system 10 may downgrade the 

system 10 receives the checkout requests from the request- protection level requested when either the checkout request 
ing system 20 identifying data to be subsetted from the data does not include all necessary or referenced data (and the 
model storage 111 on the parent system 10. These checkout 65 deficiency could not be corrected using the subset expansion 
requests are processed by checkout module 107 on the rules discussed supra) or another system has previously 

parent system 10. The flowchart in FIG. 4 illustrates gen- checked out the requested data with a protection level which 
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precludes authorization to the requesting system 20 at the manager 108 on the requesting system 20 is a single user 

requested level system. i.e.. one using the IEF Workstation Toolset, then the 

For example, if the parent system 10 has access protection modifications made to the subsetted data are stored as 

on the data to be included in the subset and the checkout records or entries in the factions data storage 113 on toe 

request from the requesting system 20 includes a request for 5 requesting system 20 by the data manager 108 on the 

delete protection, then the parent system 10 cannot grant requesting system 20. 

delete protection. The parent system 10 downgrades the If the data manager 108 on the requesting system 20 is a 

requested protection level to access protection. The protec- multi-user system, i.e.. one using the EF Client/Server 

tion level downgrades, in general, from delete to modify to Encyclopedia, then the modifications made to the subsetted 

access to read 10 da* 3 are indicated by the change status flags associated with 

Once the extinction module 201 determines what protec- the subsetted data in the data model storage Ul on the 

tion level to grant on the subsetted data, the protection level requesting system 20. Thus, on a system usmg lEFaen^ 

associated wht. the subset on theparent system 10. as shown Server Encyclopedia, the genera ed delta module 205^ as 

to block 307. is updated in acceptance with the protection shown at block 405 in FIG. S ,n response to th« ^ update 

level granted to the requesting system 20. The associated " request, creates records or entnes u. the transactions data 

wotectio™ level on the parent system 10 is updated so that storage 113 representing the modificauons made to toe 

to" enaction module 201 on the parent system* will not subsetted data as indicated by the associated change status 

grant a conflicting protection level to a subsequent subset flags- 

which includes all or part of the same data. The generate delta module 205 then cop.es toe transac- 

In the above example where the parent system 10 had 20 tions data storage 113 on toe requesting system 20 to me data 

ac«ss protection andtoe requested^ection level was model storage 111 on .toeparen. 

delete orotection which was downgraded to access at block 407, the apply module 207 on the parent system 10 

t^^^^a^pJL^ Wis not then applies thechanges in toe transactions data storage 113 

uISbe«usedeieteprc^onlu,s7c 1 b < engiveDtoany on the parent syste £ lOto toedata ^J^U 1 **" 

otoTr system. Once the associated protection level on toe 25 parent system 10. The wnsactions data storage 113 on the 

parent system 10 is updated, as shown at block 309 in FIG. parent system 10 can toen be toscaro^ 

4 the extraction module 201 on the parent system 10 then As noted earlier, the data included in the data model 

copies the subsetted data to the transactions data storage 113 storage 111 in this embodiment of toe present invention are 

on the parent system 10 and. as shown at block 311 copies objects, properties of objects and associations between 

the transactions data storage 113 on the parent system 10 to 30 objects. The values of the change status flags associated with 

the requesting system 20. The load module 201 on the an object or with an association between objects indicate 

requesting system 20. as shown at block 313. then updates that the object or the association has been changed, deleted, 

toe data model storage 111 on the requesting system 20 with unchanged, or added. The values of the change status flags 

toe subsetted data from the transactions data storage 113 on associated with a property of an object indicate that the 

the requesting system 20. property has been changed or unchanged 

Data copied to the data model storage 111 on the request- The update request issued by the user of the requesting 

ing system 20 is then accessed by users of the requesting system 20 may also include instructions to check in toe 

system 20 through the data manager 108 on the requesting . subsetted data from the data model storage 111 on toe 
system 20. The data manager 108 controls or manages that ^ requesting system 20 to the data model storage 111 on toe 

access to the subsetted data in accordance with the associ- parent system 10. If. as shown in FIG. 5 at decision block 

ated protection level granted from toe parent system 10. 409. check in of the subsetted data is requested toe apply 

» toe data manager 108 on the requesting system 20 is a module 207 on the parent system 10. as .ndicated in HO. 5 

sinlteuse ,£S2 U. L IEF Workstation Toolset, each at block 411. resets the pmtecuon level associated wito toe 
cKge Wete toe subsetted date in the data model storage 45 subsetted data on the parent system 10 to mdicate that the 

111 on the requesting system 20 is also logged to the subsetted data is no longer checked out 

transactions data storage 113 on the requesting system 20 by In response to the checkin request the apply module ^07 

the data manager 108 on the requesting system 20. If the data on the requesting system 20. as shown at block 413 in FIG. 

manager 108 on toe requesting system 20 is a multi-user 5. either clears the subsetted data from toe <^model 

system, i.e.. the IEF Client/Server Encyclopedia, any 50 *«ge 0D ue requesting system 20 or keeps toe 

changes made to toe subsetted data in the data model storage subsetted data but resets the protection level associated with 

Ul on the requesting system 20 are also indicated by the subsetted data to mdicate that the subsetted data is 

updating the change status flags associated with the subset- checked In. If the protection level associated wtth the 

ted data and included in the data model storage 111 on the subsetted data in toe data model storage 111 on the request- 
requesting system 20. 55 mg system 20 indicates that the subsetted data is checked in. 

In order to update the parent system 10. the user of toe the subsetteddata cannot be updated to toe parent system 10 

requesting system 20 makes an update request through toe "sing the update request. 

dal manager 108 on the requesting syltem 20. Update In a second enfcoduncnt of the present mvention the 

requests are processed by the update module 109 on toe requesting system 20 is a single user workstation which 
requesting syVtem 20 which includes the generate delta 60 includes toe EF Workstation Toolset 

module 205 and the apply module 207. In another embodiment of the present invention, the 

HG. 5 illustrates the operations of the update module 109 requesting system 20 and the parentsystem 10 are the same 

erf toe present invention. As shown in decision block 401 of system, which includes either the IEF Client/Server Ency- 

FIG. 5. upon receipt of an update request from a user of toe clopedia or the IEF Workstation Toolset, 
requesting system 20. generate delta module 205 checks, at 65 Although the present Invention has been described in 

decision block 403 in FIG. 5. for modifications made to the detail, it should be understood that various changes, substi- 

subsetted data on toe requesting system 20. If the data tutions and alterations can be made thereto without depart- 
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Ing from the spirit and scope of the present invention as 
defined by the appended claims. 
What is claimed is: 

1. A data processing system for providing controlled, 
multi-tiered checkout of a subset of a first data model to a 5 
second data model, said subset on said first data model 
having an associated first protection level having a first 
access type* the system comprising: 

means for generating said subset of said first data model 
in accordance with said first protection level in 10 
response to a checkout request said checkout request 
including a requested protection level; 

said generating means further including means for 
determining* in response to said first protection level 
and said requested protection level, a second protection 15 
level having a second access type associated with said 
subset; 

said generating means further including means for updat- 
ing said first protection level associated with said first 
data model in accordance with said second protection 20 
level; and 

means for updating said second data model with said 
subset and said second protection level and said second 
access type. 

2. A data processing system for providing controlled, 
multi-tiered access to a first data model, the system com- 
prising: 

means responsive to a checkout request and a first pro- 
tection level have a first access type associated with 
said first data model for generating a subset of said first 
data model, for determining a second protection level 
having a second access type associated with said 
subset, for updating said first protection level in accor- 
dance with said second protection level, and for updat- 
ing a second data model with said subset and said 
second protection level associated with said subset; 

means for managing access to said subset in accordance 
with said second protection level and said second 
access type; and 

means responsive to an update request for updating said 
first data model in accordance with said second pro- 
tection level, said second access type and modifications 
made to said subset through said managing means. 

3. A data processing system for providing controlled, 
multi-tiered access to a first data model, the system com- 
posing: 

means responsive to a checkout request and a first pro- 
tection level having a first access type associated with 
said first data model for generating a subset of said first 
data model, for determining a second protection level 
having a second access type associated with said 
subset and for updating said first protection level in 
accordance with said second protection level; 

means for updating a second data model with said subset 
and said second protection level associated with said 
subset; 

means for managing access to said subset in said second 
data model in accordance with said second protection 
level and said second access type and for indicating ^ 
modifications to said subset with change status flags 
associated with said subset in said second data model; 

means responsive to said change status flags and an 
update request for storing said modifications to said 
subset in a transactions data storage and 65 

means responsive to said update request and said trans- 
actions data storage for updating said first data model 
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in accordance with said second protection level, said 
second access type and said modifications in said 
transactions data storage. 

4. A data processing system for providing controlled, 
multi-tiered access to a first data model, the system com- 
prising: 

means responsive to a checkout request and a first pro- 
tection level having a first access type associated with 
said first data model for generating a subset of said first 
data model, for determining a second protection level 
having a second access type associated with said 
subset, for updating said first protection level in accor- 
dance with said second protection level and said second 
access type and for copying said subset and said second 
protection level associated with said subset to a trans- 
actions data storage; 
means for updating a second data model with said subset, 
said second protection level and said second access 
type associated with said subset from said transactions 
data storage; 

means for managing access to said subset in said second 
data model in accordance with said second protection 
level and said second access type and for generating 
entries in said transactions data storage, said entries 
representing modifications made to said subset; 
means responsive to an update request for locating said 
modifications to said subset in said transactions data 
storage; and 

means responsive to said locating means for updating said 
first data model in accordance with said second pro- 
tection level and said entries in said transactions data 
storage. 

5. The system of claim 4. wherein said subset generation 
means further includes means for generating said subset of 
said first data model in accordance with subset expansion 
rules. 

6. The system of claim 4, wherein said first data model 
update means further includes means for checking in said 
subset to said first data model and for modifying said first 
protection level associated with said first data model in 
response. 

7. The system of claim 6, wherein in said check in means 
further includes means for deleting said subset from said 
second data model. 

8. The system of claim 6, wherein said check in means 
further includes means for updating said second protection 
level associated with said subset in said second data model 
to indicate that said subset has been checked in. 

9. A method, on a general purpose digital computer, of 
providing controlled, multi-tiered checkout of a subset of a 
first data model to a second data model, said subset on said 
first data model having an associated first protection level 
having a first access type, comprising the steps of: 

generating said subset of said first data model in accor- 
dance with said first protection level and said first 
access type in response to a checkout request, said 
checkout request including a requested protection 
level; 

determining, in response to said first protection level and 
said requested protection level, a second protection 
level having a second access type associated with said 
subset; 

updating said first protection level associated with said 
first data model in accordance with said second pro- 
tection level; and 
updating said second data model with said subset and said 
second protection level and said second access type. 
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10. A method of providing controlled, multi-tiered access 
to a first data model, said first data model having an 
associated first protection level having a first access type, 
comprising the steps of: 

generating a subset of said first data model in accordance 
with said first protection level and said first access type 
in response to a checkout request; 

determining a second protection level having a second 
access type associated with said subset; 

updating said first protection level associated with said 
first data model in accordance with said second pro- 
tection level; 

updating a second data model with said subset and said 
second protection level; 

accessing said subset in said second data model in accor- 
dance with said second protection level and said second 
access type; and 

updating said first data model in accordance with said 
second protection level said second access type and 
modifications to said subset in said second data model 
in said accessing step in response to an update request, 

11. A method of providing controlled, multi-tiered access 
to a first data model, said first data model having an 
associated first protection level having a first access type, 
comprising the steps of: 

generating a subset of said first data model in accordance 
with said first protection level and said first access type 
in response to a checkout request; 

determining a second protection level having a second 
access type associated with said subset; 

updating said first protection level associated with said 
first data model in accordance with said second pro- 
tection level; 

copying said subset and said second protection level 
associated with said subset to a transactions data stor- 
age; 

updating a second data model with said subset and said 
second protection level from said transactions data 40 
storage; 

accessing said subset in said second data model in accor- 
dance with said second protection level and said second 
access type; 
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updating change status flags associated with said subset in 
response to said accessing step; 

generating entries in said transactions data storage repre- 
senting modifications made to said subset in response 
to an update request; and 

updating said first data model in accordance with said 
second protection level and said second access type and 
said modifications in said transactions data storage in 
response to said generating step. 

12. A method of providing controlled multi-tiered access 
to a first data model, said first data model having an 
associated first protection level having a first access type, 
comprising the steps of: 

generating a subset of said first data model in accordance 
with said first protection level and said first access type 
in response to a checkout request; 

determining a second protection level and said second 
access type associated with said subset; 

updating said first protection level associated with said 
first data model in accordance with said second pro- 
tection level; 

copying said subset and said second protection level 
associated with said subset to a transactions data stor- 
age; 

updating a second data model with said subset and said 
second protection level from said transactions data 
storage; 

accessing said subset in said second data model in accor- 
dance with said second protection level and said second 
access type; 

updating change status flags associated with said subset in 
response to said accessing step; 

generating entries is said transactions data storage repre- 
senting modifications made to said subset in response 
to said accessing step; and 

updating said first data model in accordance with said 
second protection Level said second access type and 
said modifications in said transactions data storage in 
response to an update request 
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